In the field of identity management, there are a number of known systems for providing user identity services on the Internet. Microsoft's Passport™, and the Liberty Alliance identity management system are two such known examples, as are the identity management systems taught in Canadian Patent No. 2,431,311, and Canadian Patent Application Nos. 2,458,257, 2,468,351, and 2,468,585.
Many known identity management systems offer secure logins, allowing a user to visit a site in the network (membersite) and obtain a secure login to that site using an identity store to authenticate the user identity over a secure channel. The use of a secure channel allows an identity store to provide the membersite with user login information and/or confidential user information.
However, the reliance on secure channels increases the barrier to entry for membersites. Under a secure setup, lightweight, or simple, login is encumbered by the overhead of a secure channel.
In an identity management system that relies upon homesites to act as an identity store which stores user identity information, it may be advantageous to provide a form of graduated security to allow a membersite to obtain identity information, including authentication, using a number of different channels, each with different security features.
There is a further need for a mechanism through which a webservice provider can obtain user authentication and authorization for a third party to receive information. At present, if a third party wishes to aggregate information from a number of webservice providers for the user, or if a third party requires information from a webservice provider to further process before providing the results to a user, the third party and the webservice must be heavily linked. Typically, the third party must become associated with the webservice, and have its services bundled by the webservice provider. Thus a financial institution can use an aggregation service to perform analysis on a client's holdings, but a client cannot easily obtain an aggregation across a number of financial institutions. There is therefore a need for a mechanism for third parties to provide authentication of a user authorization for release of information provided by a webservice.
There are at present a number of contact management services that allow a user to provide a list of known contacts. If the contacts provided a user subscribe to the same service, when one of the users updates a segment of a profile, the change is automatically reflected in the other users contact list. However, at present, these services are highly centralized. There is no automated mechanism to obtain information about users that have not subscribed. There is a plurality of these services, and at present there is no convenient mechanism for data exchange between them. This results in users forming small collective islands of contact sharing. There is a need for a distributed contact management system that allows users to share information with people in a vast identity management system that allows for automated updating of contact information.
It is, therefore, desirable to provide an identity management system that can provide at least one of improved gradations in the security levels, support for third party webservices and support for distributed contact management.